Data Protection Impact Assessments for Public Institutions in Nigeria

Article 4.1.5j  of the Nigerian Data Protection Regulation (NDPR) 2019 stipulates that data controllers must provide Data Protection Compliance Organisations (DPCO’s) with relevant information relating to their the policies and procedures for assessing the impact of technologies on the stated privacy and security policies as part of its audit assessment. In practice this allows for the identification of whether a Controller has implemented a Data Protection Impact Assessment (DPIA) Framework to assess risks to data subjects when they introduce new technologies or make changes to the way that they process personal data.

Section 2.6 of the recently issued NITDA “Guidelines for the management of personal data by public institutions” stipulates that every public institution shall put measures in place to ensure the confidentiality, integrity, availability and resilience of data. Public Institutions that seek to process the personal data of Nigerians from another Public Institution, a private entity or an international organisation shall demonstrate that they have conducted a DPIA and such DPIA’s be submitted to NITDA.

Section 3.2 of the guidelines provides more detail in relation to what public institutions need to do when they access and use personal data legally collected stored by another statutory body in relation to data protection impact assessments.

The section provides that these public bodies must conduct and submit a DPIA through a licensed DPCO to NITDA for consideration and feedback within 15 working days after the final version of the DPIA has been submitted.

Section 9 of the guidelines identifies the following institutions as public institutions:

“A Ministry, Department or Agency of the Federal Government, State Government Local Government or any venture funded either completely or partly by government or a company with government shareholding either at the State and Federal levels.”

The requirement to carry out a DPIA will be a new to many public entities and consequently raises the following challenges.

• what a DPIA is,
• how and when to conduct a DPIA,
• what template to use,
• what process to follow,
• who is responsible for conducting a DPIA,
• how to identify data protection and privacy risks and mitigate them,
• how to select and engage a DPCO that can assist in the development, design and implementation of a DPIA
• when to submit an accurate, adequate and fit for purpose DPIA to NITDA

At Data Analytics Privacy Technology (D.A.P.T) we provide DPIA advisory and implementation services as well as the following training and awareness courses:

• Introduction to DPIA’s: This 1-hour session is designed for senior management in public sector institutions, it provides:
  • a high-level overview of what a DPIA is,
  • a summary of the building blocks required for carrying out a DPIA,
  • information about should be involved in a DPIA,
  • an overview of senior management DPIA reporting and oversight responsibilities

• Implementing DPIA’s in Public Sector Bodies: This hands-on course takes the form of providing delegates with both theoretical and practical knowledge required to implement DPIA Frameworks into their respective working environments. It provides covers the following:
  • An overview of the Nigerian Data Protection Regulation (NDPR) and NITDA Guidelines for the management of personal data by public institutions DPIA requirements
  • Introduction to what a DPIA is
  • Identifying when a DPIA needs to be carried out
  • What information is required for a DPIA to be accurately assessed
  • How to identify, determine and mitigate risks
  • How to design a DPIA template
  • How to develop and implement the DPIA procedure
  • DPIA roles and responsibilities
  • DPIA monitoring and review process
  • Real life DPIA case studies

If you are looking for assistance and advice about DPIA’s please do not hesitate to give us a call, we will be happy to assist.